Shopify MCP Server Setup for Cursor IDE (2026)

How do you set up the Shopify MCP server in Cursor? Create a custom app in your Shopify admin (Settings → Apps and sales channels → Develop apps), configure Admin API scopes for the data you want exposed, install the app to generate an access token, then add a shopify block to ~/.cursor/mcp.json with that token and your store domain. Restart Cursor and your AI can read orders, products, and inventory without you opening the admin dashboard.

This guide covers the custom-app token route, which is the same pattern Shopify uses for any private integration into a single store. If you're building something that needs to install across multiple merchant stores, that's a different (public app, OAuth) path this guide doesn't cover.

What You Can Do With Shopify MCP in Cursor

Once connected, Cursor can typically:

Whether write operations (updating inventory, editing product descriptions, canceling orders) are available depends entirely on which Admin API scopes you grant the custom app — and it's worth being deliberate about which ones you check.

Prerequisites

Step 1: Create a Custom App in Shopify Admin

1. In your Shopify admin, go to Settings → Apps and sales channels → Develop apps
2. If this is the first custom app on the store, you may need to click Allow custom app development first
3. Click Create an app, name it something like Cursor MCP
4. Go to Configuration → Admin API integration and select scopes — start narrow: read_products, read_orders, read_inventory cover most read-only use cases. Add write_ scopes only for the specific operations you actually want the AI able to perform
5. Click Install app
6. Reveal and copy the Admin API access token — it's shown once, the same as most credential-generation flows on this site

Your store domain for API purposes is the .myshopify.com address, not a connected custom domain — find it in the admin URL bar if you're not sure which one that is.

Step 2: Install the Shopify MCP Server

npm install -g shopify-mcp-server

As with any smaller-ecosystem MCP package, verify this is still the current maintained name on npm or the MCP server directory before relying on it — package names in this space shift more than the big-platform ones do.

Step 3: Configure Cursor

Open Cursor → Settings → MCP and add the Shopify server:

{
  "mcpServers": {
    "shopify": {
      "command": "npx",
      "args": ["-y", "shopify-mcp-server"],
      "env": {
        "SHOPIFY_STORE_DOMAIN": "your-store.myshopify.com",
        "SHOPIFY_ACCESS_TOKEN": "your-admin-api-access-token"
      }
    }
  }
}

Restart Cursor to load the configuration.

Step 4: Test the Connection

In Cursor chat, try:

List my 5 most recent Shopify orders

Or:

What's the current inventory count for the "Classic Tee - Medium" variant?

A response with real order numbers or stock counts confirms the connection is working.

Step 5: Practical Workflows

Order status lookup

Check the fulfillment and payment status of order #1042 and tell me if it's shipped yet

Inventory check before a promotion

Before we launch the weekend sale, check inventory for every product in the "Summer Collection," and flag anything under 10 units

Product description drafting grounded in real data

Draft an updated product description for the "Trail Runner" shoe, using the current variants, price, and existing description in Shopify as context

Customer order history (handle with care)

Look up the order history for the customer with email jane@example.com and summarize what they've purchased

Shopify MCP vs. Stripe MCP: Different Layers of the Same Business

This site also covers the Stripe MCP server, and it's worth being clear these solve different problems even though both touch "money." Stripe is the payments layer — charges, refunds, subscriptions, disputes — and it doesn't know anything about your product catalog or what's actually in a customer's cart. Shopify is the storefront and catalog layer — products, inventory, orders, fulfillment — and while it handles checkout, many stores route the actual payment processing through Stripe or another processor under the hood.

If your AI needs to answer "did this customer get charged," that's Stripe. If it needs to answer "do we have this in stock" or "what's in this order," that's Shopify. Teams running both often end up wiring in both MCP servers rather than picking one.

Troubleshooting

"403 Forbidden" on a request
The custom app doesn't have the Admin API scope for that operation. Go back to the app's configuration in Shopify admin, add the missing scope, save, and reinstall the app — reinstalling regenerates the token, so update your config with the new value.

Access token not showing up again
Admin API access tokens are displayed once, at install time. If you didn't copy it, you'll need to uninstall and reinstall the app to generate a new one — there's no way to reveal the original value later.

"Store not found" or connection errors
Double-check you're using the .myshopify.com domain, not a custom domain connected to the store. The Admin API only recognizes the underlying Shopify domain.

Rate limit errors on bulk operations
Shopify's Admin API uses a leaky-bucket rate limit rather than a flat per-minute cap. For anything touching many products or orders at once, ask for smaller batches ("check the 10 lowest-stock products" rather than "check every product") instead of one large sweep.

Customer data showing up when you didn't expect it
If read_customers (or an equivalent broad scope) is enabled, any prompt that touches orders can surface customer names and emails as a side effect. If you don't need customer-level detail, don't grant that scope in the first place.

When Not to Use This

Be deliberate about which write scopes you grant. Letting an AI issue refunds, cancel orders, or change live pricing unattended is a meaningfully bigger blast radius than letting it read inventory counts. Start read-only, and add write scopes one at a time as you build confidence in specific workflows — not as a blanket "just in case" grant when you first set the app up. For handling customer data and access tokens generally, see MCP security best practices for 2026.

Frequently Asked Questions

Q: Does this require Shopify Plus, or does it work on a regular plan?
A: Custom apps and the Admin API are available on standard Shopify plans, not just Plus. Plus mainly affects API rate limits and some checkout-extensibility features, not whether you can create a custom app at all.

Q: Can the AI issue refunds or cancel orders?
A: Only if you grant the corresponding write scope (write_orders, for instance) when configuring the custom app. Given how consequential an accidental refund or cancellation is, most setups are better off leaving those scopes out and handling that class of action manually.

Q: I have multiple Shopify stores — can I connect to more than one?
A: Yes. Add a separate entry in mcp.json under a distinct key for each store (shopify-us, shopify-eu, for example), each with its own store domain and access token from that store's custom app.

Q: Why does my API call use a .myshopify.com address when customers see a different domain?
A: The custom domain is a DNS-level branding layer on top of the store; the Admin API always operates against the underlying .myshopify.com address regardless of what customers see in their browser.

Q: How is this different from Shopify's Storefront API?
A: The Admin API (covered here) is for store-management data — orders, inventory, customers, product editing — and requires the private access token from a custom app. The Storefront API is a separate, public-facing surface meant for building customer-facing shopping experiences, with different auth and a narrower, read-oriented scope. Most "let my AI manage my store" use cases need the Admin API, not the Storefront one.

Related Guides

---